TECHNIQUES FOR PROVIDING SCALABLE APPLICATION DELIVERY CONTROLLER SERVICES

• US 20130268646A1
• Filed: 04/04/2013
• Published: 10/10/2013
• Est. Priority Date: 04/04/2012
• Status: Active Grant

• Current Assignee: Radware Limited
• Original Assignee: Radware Limited
• Inventors: DORON, Ehud, Sekiguchi, Masato
• Granted Patent: US 9,386,085 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs

Abstract

A method for managing an application delivery controller (ADC) cluster operable in a software defined networking (SDN)-based network and including a plurality of ADC virtual appliances (VAs). The method comprises creating, by a central controller, a hash table including a plurality of buckets allocated to active VAs out of the plurality of VAs, each bucket is assigned to a range of a source internet protocol (IP) addresses of a client; and programming by the central controller at least one ingress network element connected to the ADC cluster and receive incoming traffic from clients to perform a balanced incoming traffic distribution among the plurality of VAs, wherein the traffic distribution is based in part on the allocation of the buckets to the plurality of VAs and the SIP addresses of the clients originating the incoming traffic. The plurality of VAs are virtual ADC instances operable i the plurality of physical devices.

Claims

1. A method for managing an application delivery controller (ADC) cluster in a software defined networking (SDN)-based network, wherein the method is performed by a central controller of the SDN-based network, the ADC cluster includes a plurality of physical devices, each of the plurality of physical devices includes a plurality of ADC virtual appliances (VAs), comprising:

creating, by the central controller, a hash table including a plurality of buckets allocated to active VAs out of the plurality of VAs, wherein each bucket is assigned to a range of a source internet protocol (IP) addresses of a client; and

programming by the central controller at least one ingress network element, connected to the ADC cluster and configured to receive incoming traffic from clients, to perform a balanced incoming traffic distribution among the plurality of VAs, wherein the traffic distribution is based in part on the allocation of the buckets to the plurality of VAs and the SIP addresses of the clients originating the incoming traffic.

2. The method of claim 1, further comprising:

monitoring at least a processing load of the ADC cluster;

adding at least one VA to the ADC cluster when the processing load exceeds a first threshold, wherein the first threshold indicates a peak processing load for the ADC cluster; and

removing at least one VA from the ADC cluster when the processing load is below a second threshold, wherein the second threshold indicates a low processing load for the ADC cluster.

3. The method of claim 2, wherein adding and removing at least one VA from the ADC cluster further comprising:

updating the hash table to accommodate for a new number of active VAs in the ADC cluster.

4. The method of claim 3, wherein a first group of active VAs are allocated with a first number of buckets and a second group of VAs are allocated with a second number of buckets, wherein the first number of buckets allocated for each active VA in the first group is computed as the number of buckets in the hash table divided by the number of active VAs, truncated to a closest integer number;

and wherein the second number of buckets allocated for each active VA in the second group is computed as the number of buckets in the hash table divided by the number of active VAs, truncated to a closest integer number plus one.

5. The method of claim 4, wherein updating the number of buckets in the hash table further comprising:

first transferring at least one bucket allocated for each active VA in the second group to the newly added VA; and

transferring at least one bucket allocated for each active VA in the first group to the newly added VA, only when the number of buckets allocated to the new VA has not reached the first number, thereby minimizing the changes to the buckets allocation in the hash table.

6. The method of claim 5, wherein updating the number of buckets in the hash table further comprising:

first transferring buckets allocated to the removed VA to active VAs in the first group, wherein each VA in the first group is allocated with one bucket; and

transferring remaining buckets, allocated to the removed VA, to active VAs in the second group, wherein each VA in the second group is allocated with one bucket, thereby minimizing the changes to the buckets allocation in the hash table.

7. The method of claim 3, wherein the plurality of VAs are configured with different capacities and the allocation of buckets is proportional to the capacity of each active VA.

8. The method of claim 3, wherein the number of buckets in the hash table is a function of the number of the plurality of VAs.

9. The method of claim 3, further comprising:

programming each VA affected by changes to the ADC cluster with at least one persistency rule, thereby ensuring persistency in the processing of incoming and outgoing traffic by each of the affected VAs.

10. The method of claim 1, wherein programming the at least one network element further comprising:

providing the least one network element with an instruction including at least a matching rule and an action rule, wherein the matching rule requires matching of a predefined number of lowest bits of the client'"'"'s SIP address of an incoming packet against the hash function to find a bucket associated with the SIP address and a VA designated for the bucket; and

wherein the action rule requires forwarding the incoming packet to the designated VA.

11. The method of claim 10, further comprising:

programming at least one egress network element connected to the ADC cluster to direct an outgoing packet to a VA forwarded a respective incoming packet of the incoming traffic, wherein the outgoing packet is received from the server.

12. The method of claim 11, wherein programming the at least one egress network element further comprising:

providing the least one egress network element with an instruction including a matching rule and an action rule, wherein the matching rule requires matching of a predefined number of lowest bits of a destination IP address of the outgoing packet against the hash table to find a bucket associated with the destination IP address and a VA designated for the bucket; and

wherein the action rule requires forwarding the outgoing packet to the designated VA.

13. The method of claim 11, wherein the central controller communicates with the least one ingress network element and at least one egress network element over an OpenFlow provisional protocol.

14. The method of claim 1, further comprising:

monitoring an operational status of each of the plurality of VAs in the ADC cluster; and

changing a configuration of the ADC cluster by adding or removing one or more VAs in response to the monitored operational status.

15. A non-transient computer readable medium containing instructions that when executed on the central controller performs the method of claim 1.

16. A method for managing an application delivery controller (ADC) cluster including a plurality of ADC devices and operable in a software defined networking (SDN)-based network, wherein the method is performed by a central controller of the SDN-based network, comprising:

creating, by the central controller, a hash function including a plurality of buckets allocated for the plurality of ADC devices, wherein each bucket is assigned for a range of source internet protocol (IP) addresses of a client;

monitoring at least one of a processing load of the ADC cluster and an operation status of each of the ADC device;

causing to reconfiguration of the ADC cluster in response to the monitoring, wherein the reconfiguration of the ADC cluster includes at least one of;

adding an ADC device or removing and ADC device, and updating the hash table; and

programming by the central controller at least one ingress network element connected to the ADC cluster to perform balanced traffic distribution among the plurality of ADC devices, wherein the traffic distribution is based in part on the allocation of the bucket to the plurality of ADC devices and SIP addresses of clients originating the traffic.

17. The method of claim 16, wherein adding and removing at least one ADC device further comprising:

updating the hash table to accommodate for a new number of active ADC devices in the ADC cluster.

18. The method of claim 17, wherein a first group of active ADC devices are allocated with a first number of buckets and a second group of active ADC devices are allocated with a second number of buckets, wherein the first number of buckets allocated for each active ADC device in the first group is computed as the number of buckets in the hash table divided by the number of active ADC devices, truncated to a closest integer number;

and wherein the second number of buckets allocated for each active ADC device in the second group is computed as the number of buckets in the hash table divided by the number of active ADC devices, truncated to a closest integer number plus one.

19. The method of claim 18, wherein updating the number of buckets in the hash table further comprising:

first transferring at least one bucket allocated for each active ADC device in the second group to the new added ADC device; and

transferring at least one bucket allocated for each active ADC device in the first group to a newly added ADC device, only when the number of buckets allocated to the newly ADC device has not reached the first number, thereby minimizing the changes to the buckets allocation in the hash table.

20. The method of claim 19, wherein updating the number of buckets in the hash table further comprising:

first transferring buckets allocated to the removed ADC device to active ADC devices in the first group, wherein each ADC device in the first group is allocated with one bucket; and

transferring remaining buckets, allocated to the removed ADC device, to active ADC devices in the second group, wherein each ADC device in the second group is allocated with one bucket, thereby minimizing the changes to the buckets allocation in the hash table.

21. The method of claim 17, wherein the plurality of ADC devices are configured with different capacities and the allocation of buckets is proportional to the capacity of each active VA.

22. The method of claim 17, further comprising:

programming each ADC device affected by changes to the ADC cluster with at least one persistency rule, thereby ensuring persistency in the processing of incoming and outgoing traffic by each of the affected ADC devices.

23. A central controller for managing an application delivery controller (ADC) cluster in a software defined networking (SDN)-based network, comprising:

a cluster management module for creating, by the central controller, a hash table including a plurality of buckets allocated to active VAs out of the plurality of VAs, wherein each bucket is assigned to a range of a source Internet protocol (IP) addresses of a client; and

a network-interface module for instructing the least one ingress network element connected to the ADC cluster to perform a balanced traffic distribution among the active VAs, wherein the traffic distribution is based in part on the allocation of the buckets to the active VAs and the SIP addresses of clients originating the traffic.

24. The central controller of claim 23, wherein the cluster management module is further configured to:

monitor at least a processing load of the ADC cluster;

add at least one VA to the ADC cluster when the processing load exceeds a first threshold, wherein the first threshold indicates a peak processing load for the ADC cluster;

remove at least one VA from the ADC cluster when the processing load is below a second threshold, wherein the second threshold indicates a low processing load for the ADC cluster; and

update the hash table to accommodate for a new number of active VAs in the ADC cluster.

25. The central controller of claim 24, wherein the plurality of ADC devices are configured with difference capacity and the allocation of buckets is proportional to the capacity of each active VA.

26. The central controller of claim 24, wherein the network-interface module is further configured to:

program each VA affected by changes to the ADC cluster with at least one persistency rule, thereby ensuring persistency in the processing of incoming and outgoing traffic by each of the affected VAs.